CUI and Government Document Destruction: NSA/CSS 02-01 Requirements
Share
Controlled Unclassified Information must be destroyed so that it is “unreadable, indecipherable, and irrecoverable”, using a method required by law for that category of CUI or, failing that, the guidance in NIST SP 800-53 and SP 800-88. Classified national security information is a different and stricter matter: paper must go through a shredder evaluated against NSA/CSS Specification 02-01 and named on the NSA Evaluated Products List.
Those are two separate regimes, and conflating them is the most common and most expensive mistake in government procurement of destruction equipment. Buying an EPL-listed machine for a CUI-only environment wastes money and throughput. Buying a P-7 machine that is not on the EPL for a classified environment fails the requirement outright. This article separates them.
What CUI is
Controlled Unclassified Information is information the US Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that requires safeguarding or dissemination controls under law, regulation or Government-wide policy — but that is not classified. It was established as a single Executive-branch programme by Executive Order 13556 and is implemented through 32 CFR Part 2002, administered by the Information Security Oversight Office at NARA.
CUI replaced a sprawl of agency-invented markings such as For Official Use Only, Sensitive But Unclassified and Law Enforcement Sensitive. The CUI Registry, published by NARA, lists the authorised categories — things like Privacy, Procurement and Acquisition, Critical Infrastructure, Export Control and Controlled Technical Information — and identifies which are Basic and which are Specified.
That Basic/Specified distinction drives the destruction requirement, so it is worth understanding:
- CUI Basic — the underlying authority requires safeguarding but does not spell out how. The default CUI Program controls apply.
- CUI Specified — the underlying law, regulation or Government-wide policy prescribes specific controls, which may include a specific destruction method. Those specific controls win.
What 32 CFR 2002 requires for destruction
The destruction provision sits at 32 CFR 2002.14(f). Two conditions govern when you may destroy: the agency no longer needs the information, and records disposition schedules published or approved by NARA permit it. Destroying CUI that is still under a records schedule is a records violation regardless of how thoroughly you shredded it.
On how, the standard is that CUI must be rendered unreadable, indecipherable, and irrecoverable. The regulation then sets an order of precedence:
- Any method of destruction specifically required by law, regulation or Government-wide policy for that CUI category. If your CUI is Specified and the underlying authority names a method, use it.
- Otherwise, the guidance for destruction in NIST SP 800-53 and NIST SP 800-88, both incorporated by reference.
- Or any method approved for Classified National Security Information as set out in 32 CFR 2001.47.
What that means in millimetres
Route 2 is the one most organisations land on, and it produces a concrete figure. NIST Special Publication 800-88 Rev. 1, in its media sanitization guidance, states:
“Destroy paper using cross cut shredders which produce particles that are 1 mm x 5 mm (0.04 in. x 0.2 in.) in size (or smaller), or pulverize/disintegrate paper materials using disintegrator devices equipped with a 3/32 in. (2.4 mm) security screen.”
A 1 mm by 5 mm particle has an area of 5 mm². That is the same target as DIN 66399 P-7. So an organisation that follows the NIST route for CUI is, in equipment terms, buying at the same particle specification as classified destruction — without necessarily needing an EPL-listed model, because 800-88 states a specification and does not require a specific evaluated product.
This surprises people, and it is worth being careful about. Agencies and contracts vary in how strictly they read the NIST figure, and some accept a lower level for CUI on a documented risk basis. Check your contract, your agency's implementing policy and your security officer's position before assuming either that P-5 is enough or that only an EPL machine will do. Where the contract is silent, the 800-88 figure is the safest reading of 32 CFR 2002.14(f).
NSA/CSS Specification 02-01 and the Evaluated Products List
Classified national security information — Confidential, Secret, Top Secret — is governed separately, and the destruction equipment must be evaluated by the National Security Agency.
What the specification says
NSA/CSS Specification 02-01 governs high security crosscut paper shredders. The NSA/CSS Evaluated Products List for high security crosscut paper shredders states that approved machines must reduce paper documents to shards measuring five millimetres square or less in area, and notes that one millimetre by five millimetres is the most common resulting particle size.
So the destruction target is a maximum particle area of 5 mm². The specification is one of a family: NSA/CSS specifications also cover optical media destruction devices, degaussers, disintegrators and other equipment classes, each with its own evaluated products list.
What the Evaluated Products List actually is
The EPL is a list of specific makes and models that the NSA has tested against a specification and found to meet it. It is not a standard, a certificate or a self-declaration. A product is either named on the current list or it is not.
Three consequences follow, and each of them matters at procurement:
- Meeting the particle specification is not the same as being listed. A machine can reliably produce 1 mm by 5 mm particles and still not appear on the EPL, because no one submitted it for evaluation. For classified material, the listing is the requirement.
- A DIN level is not an NSA listing. “P-7” is a European output specification stated by the manufacturer. It is useful shorthand and it is not evidence of NSA evaluation. Vendors who write “NSA Level 7” are combining two unrelated systems; NSA does not issue DIN levels.
- Listings are model-specific and change. Products are added and removed, and a listing attaches to an exact model designation, not to a product family or a brand. A successor model is not covered by its predecessor's listing.
The practical instruction is therefore simple: download the current EPL from nsa.gov and match the exact model number before you raise a purchase order. Do not rely on a reseller's summary, a product page badge or a datasheet claim — including ours. Our government shredder range is a starting point for narrowing candidates; the list is the authority.
Who needs what
| Your situation | What normally governs | Practical equipment position |
|---|---|---|
| Handling classified national security information (Confidential/Secret/Top Secret) | 32 CFR 2001.47 and the applicable NSA/CSS specification | A shredder named on the current NSA EPL. Nothing else satisfies it. |
| Federal agency or contractor handling CUI Specified with a prescribed destruction method | The underlying law, regulation or Government-wide policy | Whatever that authority prescribes. |
| Federal agency or contractor handling CUI Basic | 32 CFR 2002.14(f), routing to NIST SP 800-53 / 800-88 | 1 mm x 5 mm particle (5 mm²), or a disintegrator with a 3/32 in. security screen. Confirm your agency's reading. |
| Defence contractor under DFARS 252.204-7012 handling Controlled Technical Information | NIST SP 800-171 and your contract | Follow the contract; where silent, the 800-88 figure is the defensible baseline. |
| Commercial organisation with sensitive but unregulated material | Your own risk assessment | P-5 or P-6 is normally proportionate; P-7 is usually over-specified. |
Practical considerations before you buy high security
High security machines are not simply better versions of office shredders. They behave differently and the operational cost is real.
- Throughput collapses. Sheet capacity per pass at the 5 mm² particle size is a fraction of a P-4 machine's. Size the machine against your genuine daily paper volume, measured rather than estimated.
- Waste volume rises sharply. Particles that small do not compact the way strips do. Expect to change bags far more often, and plan the collection and disposal chain for the resulting volume.
- Dust management matters. Fine paper dust is a genuine operational and air quality issue at these particle sizes. Many high security machines are specified with filtration for exactly this reason.
- Lubrication is not optional. Fine cutting heads are the least tolerant of neglect of any shredder type. Budget for shredder oil and build oiling into the operating procedure rather than leaving it to whoever notices.
- Media other than paper needs its own solution. Optical discs, hard drives, SSDs and tapes each fall under different NSA specifications and different evaluated products lists. A paper shredder with a CD slot does not address classified optical media. See digital media shredders.
Frequently Asked Questions
Does CUI require an NSA-listed shredder?
Not by default. 32 CFR 2002.14(f) requires that CUI be rendered unreadable, indecipherable and irrecoverable, using a method prescribed by the governing authority if there is one, otherwise NIST SP 800-53 and SP 800-88 guidance, or a method approved for classified information. The NIST route gives a 1 mm x 5 mm particle specification without requiring a specific evaluated product. Individual agencies and contracts can and do impose stricter terms, so confirm yours.
Is a P-7 shredder automatically NSA approved?
No. P-7 is a DIN 66399 output level declared by the manufacturer. An NSA listing means a specific make and model has been evaluated against NSA/CSS Specification 02-01 and appears on the Evaluated Products List. The two frequently coincide, but one does not imply the other, and for classified material only the listing counts.
Where do I find the current Evaluated Products List?
The NSA publishes its media destruction guidance and evaluated products lists on nsa.gov under Resources. Always work from the current document rather than a cached copy or a vendor's transcription, and match the exact model designation.
What particle size does NSA/CSS 02-01 require?
The NSA/CSS Evaluated Products List for high security crosscut paper shredders states that approved machines must reduce paper to shards of five millimetres square or less in area, with one millimetre by five millimetres cited as the most common particle size. NIST SP 800-88 Rev. 1 uses the same 1 mm x 5 mm figure for paper destruction.
Can I use a disintegrator instead of a shredder?
For CUI following the NIST route, yes — SP 800-88 explicitly permits pulverizing or disintegrating with a device equipped with a 3/32 in. (2.4 mm) security screen. For classified material, disintegrators fall under their own NSA specification and evaluated products list, so the device must be listed for that purpose.
Do these rules apply to contractors as well as agencies?
Generally yes, through the contract. The CUI Program reaches entities that possess CUI for or on behalf of the Government, and defence contracts commonly flow down requirements through DFARS 252.204-7012 and NIST SP 800-171. The specific obligation always comes from your contract and your facility's security plan, so read those first.
This article is general guidance for facilities, security and procurement staff and is not legal advice. It reflects 32 CFR Part 2002 as published on eCFR, NIST SP 800-88 Rev. 1, and the NSA/CSS Evaluated Products List for High Security Crosscut Paper Shredders. Requirements change; verify against the current primary sources and your contracting officer or security officer before purchase.